CVE-2026-81315: ash_ai's MCP server accepts a DNS-rebound origin because both the host and the scheme come from attacker-controlled headers

NVD·high signalXBlueskyLinkedInCopy link

NVD published this 7.4 HIGH origin-validation flaw on 2026-08-31. In AshAi.Mcp.Server with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, but conn.host comes from the Host header and the scheme is read from raw x-forwarded-proto with no trusted-proxy check. Under DNS rebinding a malicious web page can issue cross-site requests to a developer's local MCP server as that user's actor.